Re: The official disk encryption guide seems a bit lacking (detailed list of concrete improvement suggestions!)

[Greg Troxel <gdt%lexort.com@localhost>]

Ellie <el%horse64.org@localhost> writes:

> On 10/28/26 9:06 AM, nia wrote:
>> I asked about this a while ago, and was told that the implementation
>> of AES-CBC in cgd(4) offers theoretical better security. AES-XTS
>> offers theoretical better performance. 
> I always thought that XTS was the more secure one, due to supposedly
> being a little more tampering resistant:
> https://crypto.stackexchange.com/questions/5587/what-is-the-advantage-of-xts-over-cbc-mode-with-diffuser
>
> But I'm not at all an expert, so I apologize if XTS over CBC is
> actually a bad idea.
>
> Perhaps it might be useful if the guide had a few notes on *why* a
> specific option is recommended over another.

First, I think basic recommendations belong in the man page, if they are
compact enough.  They are already there in cgd(4), mostly.   Perhaps
cgdconfig should point to that more loudly.

The problem with this discussion is that saying disk encryption uses
"CBC" is very underspecified.  True CBC has an IV, and then further
blocks use previous state as IVs (leaving out details as not important
to this discussion).  You can't use that for disk encryption because of
the need to read/write blocsk with random access.  cgd's "AES-CBC" says

  The CBC initialization vector for each disk sector is chosen to be the
  encryption under AES of the little- endian encoding of the disk sector
  number.
  
and reading the web briefly, it seems that choosing to use the encrypted
block number avoids some of the attacks, and thus this specific form of
CBC seems stronger than XTS.

It would take a reference to an open-access peer-reviewd paper (not from
a scheme proponent) to convince me really firmly (vs mildly now) that
our AES-CBC is stronger, or that our AES-XTS is stronger.  Yes, my
academic bias is showing; I took a graduate cryptography course long
ago, but it was "modern" cryptography, not block ciphers.